Rockwell FactoryTalk JWT Auth Bypass Flaw
A JWT signature validation flaw in Rockwell Automation's FactoryTalk Services Platform lets low-privileged users forge tokens and impersonate authorized users.
CISA and Rockwell Automation disclosed a vulnerability, CVE-2026-10714, in FactoryTalk Services Platform (FTSP) version 6.60, used to manage authentication and directory services across Rockwell's industrial automation products. The flaw arises because FTSP fails to verify that JWT tokens are signed using RSA during Okta Web Authentication, allowing an attacker to set the algorithm field to "none" and craft forged tokens that bypass signature validation entirely.
An authenticated low-privilege user exploiting this weakness could impersonate any authorized user on the FTSP server, gaining unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP. This could enable privilege escalation across an industrial control environment. The vulnerability is not exploitable remotely, and CISA states no known public exploitation has been reported. Rockwell has released a patch (RAID 1158263) or the February 2026 Patch Roll-up to remediate the issue, with additional guidance available via Rockwell's advisory SD1786.
The affected platform is deployed worldwide within Critical Manufacturing sector environments. Organizations unable to immediately patch are advised to follow Rockwell's security best practices, isolate control system networks from business networks and the internet, and use secure remote access methods such as VPNs.
Mentioned in this report
Detection guidance
JWT Authentication Token Using Algorithm None
Detects authentication tokens (JWT) presented with the algorithm field set to "none", indicating an attempt to bypass signature verification such as in the FactoryTalk Services Platform Okta authentication bypass (CVE-2026-10714). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: JWT Authentication Token Using Algorithm None
description: Detects JWT tokens submitted to an authentication or identity service
with the alg field set to "none", a technique used to bypass RSA signature verification
and forge authenticated sessions, as seen in the FactoryTalk Services Platform Okta
auth bypass (CVE-2026-10714). Generalises on the JWT header alg:none pattern rather
than any specific forged token value.
tags:
- attack.defense_evasion
- attack.credential_access
- attack.t1606
logsource:
category: application
product: windows
detection:
selection:
Message|contains:
- '"alg":"none"'
- '"alg": "none"'
filter_base64_header:
Message|contains: eyJhbGciOiJub25lIn0
condition: selection or filter_base64_header
falsepositives:
- Development or test environments intentionally using unsigned JWTs for debugging
- Security scanning/pentest tools probing authentication endpoints for algorithm confusion
vulnerabilities
level: high
id: e8d60488-4599-58bb-82d9-ebb45dbded97
status: experimental
author: Vorant
Privilege Grant to Additional Systems Following Low-Privilege Authenticated Session
Detects an authenticated low-privilege account performing administrative permission-grant actions on an industrial platform shortly after authentication, consistent with impersonation via a forged authentication token to escalate privileges across connected systems. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Permission Grant Actions Performed Shortly After Low-Privilege Session Start
description: Detects administrative permission or role-grant actions performed by
an account under a session that began with low-privilege authentication, consistent
with token impersonation/privilege escalation abuse such as the FactoryTalk Services
Platform JWT bypass (CVE-2026-10714). This behaviour should be tuned to the organisation's
identity/audit log schema; the condition captures the sequence pattern rather than
a specific account name.
tags:
- attack.privilege_escalation
- attack.t1078
logsource:
category: application
product: windows
detection:
selection_grant:
Message|contains:
- PermissionGranted
- RoleAssigned
- AccessGranted
selection_lowpriv:
Message|contains:
- AuthenticationLevel=Low
- Role=User
condition: selection_grant and selection_lowpriv
falsepositives:
- Legitimate delegated administration workflows where low-privilege operator accounts
are used to request approved permission changes
- Automated provisioning scripts that assign roles using service accounts logged with
low default privilege levels
level: medium
id: a6e08f65-4d6e-577a-a15d-e3d4402fc1c6
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-07
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free